Definition
STARTTLS is a protocol extension that allows an email server to upgrade an existing plaintext connection to an encrypted connection using TLS or SSL. Unlike SMTPS (which uses a separate port and encrypts from the start), STARTTLS starts as an unencrypted connection and then requests encryption using the STARTTLS command.
STARTTLS is the most common method for encrypting email transmission today. It is supported on ports 587 and 25 for SMTP, as well as for IMAP (port 143) and POP3 (port 110).
How STARTTLS Works
- The sending server connects to the receiving server on a standard port (25 or 587)
- The sending server issues the EHLO command
- If the receiving server supports STARTTLS, it includes STARTTLS in its capability list
- The sending server issues the STARTTLS command
- The servers negotiate a TLS handshake and encrypt the connection
- All subsequent communication is encrypted
If the receiving server does not support STARTTLS, the sending server can either proceed with an unencrypted connection or refuse to send depending on its configuration.
STARTTLS vs SMTPS
| Factor | STARTTLS | SMTPS |
|---|---|---|
| Port | 25 or 587 | 465 |
| Connection start | Plaintext, upgraded to encrypted | Encrypted from the start |
| TLS negotiation | After STARTTLS command | During connection handshake |
| Firewall compatibility | Standard ports | May require opening port 465 |
| Modern support | Widely adopted | Legacy, still supported |
Why STARTTLS Matters for Email Marketing
- Data protection: STARTTLS prevents interception of email content during transmission between servers
- Deliverability: Some mailbox providers downgrade deliverability for senders that do not support TLS connections
- Compliance: Regulations including GDPR require appropriate security measures for personal data in transit
- MTA-STS integration: MTA-STS (Mail Transfer Agent Strict Transport Security) builds on STARTTLS to enforce encrypted delivery
MTA-STS and STARTTLS
MTA-STS is a protocol that prevents downgrade attacks against STARTTLS. Without MTA-STS, a man-in-the-middle attacker could strip the STARTTLS capability from the EHLO response, forcing the sending server to transmit unencrypted. MTA-STS tells sending servers that a domain requires TLS and specifies which certificates are valid.
Related Glossary Terms
A/B Testing
A/B testing in email marketing is the practice of sending two variations of an email to a small sample of your list to determine which version performs better before sending the winner to the remaining subscribers.
Abandoned Cart Email
An abandoned cart email is an automated message sent to customers who added items to their online shopping cart but left without completing the purchase. It is one of the highest-converting email types in ecommerce.
AIDA Model for Email
The AIDA model (Attention, Interest, Desire, Action) is a classic copywriting framework used to structure email campaigns that guide subscribers from awareness to conversion.
AMP for Email
AMP for Email is a Google-developed framework that allows email messages to include interactive elements like forms, carousels, accordions, and live content. It turns static emails into dynamic, interactive experiences directly inside the inbox.
Announcement Email
An announcement email is a dedicated campaign that communicates a specific update, milestone, or change to subscribers, from product launches and feature releases to company news and events.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Frequently Asked Questions
STARTTLS is secure when properly implemented, but it is vulnerable to downgrade attacks where an attacker intercepts the initial connection and removes the STARTTLS capability from the server response before it reaches the sender. MTA-STS and DANE are complementary protocols that prevent these downgrade attacks.
Use online tools like MX Toolbox, CheckTLS, or the Test TLS tool by the TLS Working Group. Most major email providers including Gmail, Outlook, and Yahoo support STARTTLS.
Reputable email marketing platforms and SMTP relays support STARTTLS. Most sending platforms default to using TLS when available and fall back to plaintext when the receiving server does not support STARTTLS. Configuring your platform to refuse plaintext delivery provides the strongest security.
TLS is the encryption protocol used to secure the connection. STARTTLS is the command that initiates the TLS handshake over an existing connection. The terms are related but distinct: TLS is the encryption itself, STARTTLS is how you get to encrypted communication on a standard port.
Some mailbox providers consider TLS support when evaluating sender reputation. Sending without encryption can result in lower inbox placement rates. Major providers including Gmail and Outlook require TLS for bulk senders. Enabling STARTTLS is a basic requirement for professional email sending.